Skip to content
OpenAdvisories
Medium RHSA-2025:3772 2 CVEs

Red Hat Security Advisory: go-toolset:rhel8 security update

Published Apr 10, 2025 · Updated Oct 17, 2026

Ecosystem: Red Hat

Fixed packages 10

ReleasePackageFixed in
Red Hat · RHEL 8 enterprise_linux:8::appstream delve 0:1.24.1-1.module+el8.10.0+22945+b2c96a17
Red Hat · RHEL 8 enterprise_linux:8::appstream delve-debuginfo 0:1.24.1-1.module+el8.10.0+22945+b2c96a17
Red Hat · RHEL 8 enterprise_linux:8::appstream delve-debugsource 0:1.24.1-1.module+el8.10.0+22945+b2c96a17
Red Hat · RHEL 8 enterprise_linux:8::appstream go-toolset 0:1.23.6-1.module+el8.10.0+22945+b2c96a17
Red Hat · RHEL 8 enterprise_linux:8::appstream golang 0:1.23.6-1.module+el8.10.0+22945+b2c96a17
Red Hat · RHEL 8 enterprise_linux:8::appstream golang-bin 0:1.23.6-1.module+el8.10.0+22945+b2c96a17
Red Hat · RHEL 8 enterprise_linux:8::appstream golang-docs 0:1.23.6-1.module+el8.10.0+22945+b2c96a17
Red Hat · RHEL 8 enterprise_linux:8::appstream golang-misc 0:1.23.6-1.module+el8.10.0+22945+b2c96a17
Red Hat · RHEL 8 enterprise_linux:8::appstream golang-src 0:1.23.6-1.module+el8.10.0+22945+b2c96a17
Red Hat · RHEL 8 enterprise_linux:8::appstream golang-tests 0:1.23.6-1.module+el8.10.0+22945+b2c96a17

Vulnerabilities 2

  • Medium 6.1
    CVE-2024-45336

    Sensitive headers incorrectly sent after cross-domain redirect in net/http

    The HTTP client drops sensitive headers after following a cross-domain redirect. For example, a request to a.com/ containing an Authorization header which is redirected to b.com/ will not send that header to b.com. In the event that the client received a subs…

    Go standard library net/http golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  • Medium 6.1
    CVE-2024-45341

    Usage of IPv6 zone IDs can bypass URI name constraints in crypto/x509

    A certificate with a URI which has a IPv6 address with a zone ID may incorrectly satisfy a URI name constraint that applies to the certificate chain. Certificates containing URIs are not permitted in the web PKI, so this only affects users of private PKIs whi…

    Go standard library crypto/x509 golang go Debian Ubuntu Azure Linux Alpine Wolfi Go

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2341750
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2341751
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_3772.json
  • report
    https://access.redhat.com/security/cve/CVE-2024-45336
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2024-45336
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2024-45336
  • article
    https://github.com/golang/go/issues/70530
  • article
    https://groups.google.com/g/golang-announce/c/sSaUhLA-2SI
  • report
    https://access.redhat.com/security/cve/CVE-2024-45341
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2024-45341
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2024-45341
  • article
    https://github.com/golang/go/commit/2b2314e9f6103de322b2e247387c8b01fd0cd5a4
  • article
    https://github.com/golang/go/issues/71156